​​Beyond source code: A path to the keys to the kingdom

Storm-3068 exploited a self-service password reset mechanism to gain initial access, highlighting how weak identity controls can serve as a launchpad for deep infrastructure compromise. Once inside, the threat actor abused trusted CI/CD pipelines — a classic supply chain attack vector — to harvest credentials and move laterally into Azure DevOps and Kubernetes environments without ever deploying traditional malware. This matters because development pipelines are often implicitly trusted by cloud infrastructure, meaning a single compromised identity can cascade into full environment takeover. The attack demonstrates that 'keys to the kingdom' increasingly live not in production systems, but in the overlooked identity and pipeline layers that serve them.